The IEC 62443/ISA 99 standard
It is a fact that industrial plants are increasingly targeted by cyber attacks that are ever more specific and ever more dangerous. After Trisis/Triton, we are no longer talking about a possible “simple” loss of production when a plant is attacked, but about a threat to the physical safety of people (Safety), who following a cyber attack could even pay with their lives.
In light of this, we can say that in an industrial plant, Security is as important as Safety, since if the former is compromised, the latter is also at serious risk.
We increasingly hear about the IEC 62443 standard, also known as ISA 99. But what is it? Is it mandatory? Where does it apply? And above all, how is it implemented from an IT point of view? In this article we try to answer these questions.
What is IEC 62443 / ISA 99?
The International Society of Automation (ISA) created this standard with the intention of making Industrial Automation Control Systems (IACS) infrastructure secure against cyber threats.
This standard is widely used and, fortunately, demand for compliance is growing, thanks to the awareness that the whole ecosystem (end customers, manufacturers, suppliers, installers) is developing.
The ISA 99 standard is divided into 4 main areas:
- General documents, which describe the fundamental points of the industrial processes concerned;
- Policies and procedures, which highlight the importance of following procedures that involve everyone affected by the processes, rather than entrusting security to simple tools;
- Systems, procedures and documentation on the implementation of security systems,
- Components, which describe the technical security requirements to be met.
Is adopting IEC 62443 / ISA 99 mandatory?
No, except in some critical infrastructure (major transport infrastructure and energy production of national interest).
Unfortunately, there are currently important regulations that cover Safety, but not Security. As already said, these areas are closely linked, and in all likelihood they will soon be integrated into specific regulations.
Where does it apply?
The standard should be adopted by the entire chain of parties involved in the design, implementation and maintenance of production plants.
The sectors of application are diverse, namely all the fields in which ICS systems are present. Here are some example sectors:
- Energy (nuclear, hydroelectric, renewable energy, etc.);
- Transport (rail, cable transport systems, etc.);
- Pharmaceutical/medical;
- Manufacturing (metalworking, chemical, steel, etc.).
How to implement it
The IEC 62443 / ISA 99 standard requires several phases to be achieved, and it should be pointed out right away that it is not a matter of simple IT tools and/or configurations.
As already highlighted, security is a process. And specifically, security is a process that involves not only ICS objects (PLCs, RTUs, actuators, motors, valves, PCs, software and so on), but at its centre are people.
Focusing on the purely IT aspect, the standard introduces several concepts:
- Multi-layer security;
- Knowing the connected devices;
- Defining authorisation and authentication;
- Protocol encryption;
- Log recording.
Multi-layer security
It is clear that all the points listed above are essential to achieve the goal. However, the concept of multi-layer security is the most developed in the ISA 99 documents.
One of the main problems in plant networks is the presence of heterogeneous devices. Leaving a webcam on the same network segment as a PLC that controls a hydraulic turbine is not a good idea at all. A possible vulnerability in a webcam (see Mirai Botnet) can compromise the entire production system.
In this way ISA 99 introduced the concept of layered security, where devices and services must be placed according to the risk factor. In particular, several security levels are identified, where production equipment (e.g. valves, turbines, motors, etc.) must be placed at the level that is hardest for a cyber threat to reach.
Below is a hypothetical segmentation diagram proposed by Fortinet:
Knowing the connected devices
As we have already stressed in other cases, it is essential to know which devices are present on the network, whether any are added to an unauthorised network segment, and whether they have vulnerabilities.
Defining authorisation and authentication
Building a network with a hierarchical structure of authorisations is very important. Giving people the right access privileges prevents a breach of any single account from making the entire system vulnerable.
Protocol encryption
The legacy protocols used in ICS systems (Modbus, Profibus, 104, etc.) are by their nature insecure and exposed to typical man-in-the-middle attacks. For this reason it is necessary either to choose more secure protocols such as OPC UA, or to protect the entire network segment with robust encryption such as TLS. This aspect is widely recommended by the IEC 62443 standard.
Log recording
Finally, it is very important to keep track of all the events that occur on the network, so as to constantly monitor the state of security. In the event of a breach, logs will be essential to facilitate forensic analysis. It is clear that in such critical environments, adopting SIEM systems greatly facilitates threat analysis and also makes it possible to use automation to limit threats.
Conclusions
The IEC 62443 standard, also known as ISA 99, is an excellent reference for building an ICS infrastructure that is secure against increasingly pressing cyber threats. Just as the GDPR has become a rule that all companies must comply with, it is desirable that ISA 99 too become a mandatory standard to be applied in all ICS plants, wherever there is a potential threat to people’s safety should the IT system be compromised.